Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2019-10755

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 55.3%
CVSS Severity
CVSS v3 Score 4.9
CVSS v2 Score 4.0
Products affected by CVE-2019-10755
  • Pac4j » Pac4j » Version: 3.0.0
    cpe:2.3:a:pac4j:pac4j:3.0.0
  • Pac4j » Pac4j » Version: 3.0.1
    cpe:2.3:a:pac4j:pac4j:3.0.1
  • Pac4j » Pac4j » Version: 3.0.2
    cpe:2.3:a:pac4j:pac4j:3.0.2
  • Pac4j » Pac4j » Version: 3.1.0
    cpe:2.3:a:pac4j:pac4j:3.1.0
  • Pac4j » Pac4j » Version: 3.2.0
    cpe:2.3:a:pac4j:pac4j:3.2.0
  • Pac4j » Pac4j » Version: 3.3.0
    cpe:2.3:a:pac4j:pac4j:3.3.0
  • Pac4j » Pac4j » Version: 3.4.0
    cpe:2.3:a:pac4j:pac4j:3.4.0
  • Pac4j » Pac4j » Version: 3.5.0
    cpe:2.3:a:pac4j:pac4j:3.5.0
  • Pac4j » Pac4j » Version: 3.6.0
    cpe:2.3:a:pac4j:pac4j:3.6.0
  • Pac4j » Pac4j » Version: 3.6.1
    cpe:2.3:a:pac4j:pac4j:3.6.1
  • Pac4j » Pac4j » Version: 3.7.0
    cpe:2.3:a:pac4j:pac4j:3.7.0
  • Pac4j » Pac4j » Version: 3.8.0
    cpe:2.3:a:pac4j:pac4j:3.8.0
  • Pac4j » Pac4j » Version: 3.8.1
    cpe:2.3:a:pac4j:pac4j:3.8.1
  • Pac4j » Pac4j » Version: 3.8.2
    cpe:2.3:a:pac4j:pac4j:3.8.2


Products
Pricing
Contact Us

Shodan ® - All rights reserved